4 ms·
Not disclosing vulnerabilities is not a question of attacking or defending, it's just stupid to keep vulnerabilities open. I also didn't propose to uncompromis
by bayesianhorse 12y ago
Not disclosing vulnerabilities is not a question of attacking or defending, it's just stupid to keep vulnerabilities open.
I also didn't propose to uncompromisingly favor attack capabilities. I still don't think effective cyber defense is possible on a national level without leading the edge on offensive abilities as well.
- teamhappy 12y agoI really don't want to explain it a third time, so let me just ask you a question instead: How do you lead the edge on offensive abilities without keeping vulnerabilities/bugs secret? Let me rephrase that: How do you lead the edge on offensive abilities without weakening the security of the people who are paying your salary; the very same people you swore an oath to protect? Please explain to me how that is possible on a technical level. If you can't, or you still don't really understand what I'm talking about, that's fine. Just ask. --- I'm gonna explain it a third time. (Looks like you don't want to talk to me.) Having offensive abilities means having one or more remote exploits ready to use. Having remote exploits ready to use means sitting on undisclosed vulnerabilities. Sitting on undisclosed vulnerabilities means weakening the security of the people you're supposed to protect. It's quite simple, really. You can't remotely attack a computer without remote exploits. I only count remote attacks as "cyber warfare".
- bayesianhorse 12y agoRemote exploits work surprisingly well on unpatched systems, stupid users, malconfigured hardware/software and if that doesn't work, maybe it's time for a bit of oldfashioned humint.